codex

mirror of https://github.com/pchuan98/codex.git synced 2026-07-01 00:31:56 +08:00

Files

T

viyatb-oai 62d0f302fd fix(core): canonicalize wrapper approvals and support heredoc prefix … (#10941 )

## Summary
- Reduced repeated approvals for equivalent wrapper commands and fixed
execpolicy matching for heredoc-style shell invocations, with minimal
behavior change and fail-closed defaults.

## Fixes
1. Canonicalized approval matching for wrappers so equivalent commands
map to the same approval intent.
2. Added heredoc-aware prefix extraction for execpolicy so commands like
`python3 <<'PY' ... PY` match rules such as `prefix_rule(["python3"],
...)`.
3. Kept fallback behavior conservative: if parsing is ambiguous,
existing prompt behavior is preserved.

## Edge Cases Covered
- Wrapper path/name differences: `/bin/bash` vs `bash`, `/bin/zsh` vs
`zsh`.
- Shell modes: `-c` and `-lc`.
- Heredoc forms: quoted delimiter (`<<'PY'`) and unquoted delimiter (`<<
PY`).
- Multi-command heredoc scripts are rejected by the fallback
- Non-heredoc redirections (`>`, etc.) are not treated as heredoc prefix
matches.
- Complex scripts still fall back to prior behavior rather than
expanding permissions.

---------

Co-authored-by: Dylan Hurd <dylan.hurd@openai.com>

62d0f302fd · 2026-02-10 11:46:40 -08:00

History

handlers

Always expose view_image and return unsupported image-input error (#11336 )

2026-02-10 11:25:12 -08:00

runtimes

fix(core): canonicalize wrapper approvals and support heredoc prefix … (#10941 )

2026-02-10 11:46:40 -08:00

context.rs

feat(app-server, core): allow text + image content items for dynamic tool outputs (#10567 )

2026-02-04 16:12:47 -08:00

events.rs